App spoofing | Pixalate Docs

App spoofing is a form of invalid traffic (IVT) in which traffic from one app is misrepresented as traffic from another, usually to make the inventory look more valuable. It affects both mobile apps and connected TV (CTV) apps.

Spoofed traffic can come from:

real devices used as a botnet
real devices that are unaware of spoofing happening in the background
artificial impressions generated by fake devices

How Pixalate detects app spoofing

Pixalate flags app spoofing when the app identifier reported in the bid request, such as the bundle ID, doesn’t match the characteristics of the app that Pixalate detects directly.

Pixalate’s IVT detection technology identifies the true bundle ID, user agent and other properties of an impression, even when the bidstream declares something else. When these don’t match, the impression is flagged as IVT with the AppSpoofing SIVT type. Spoofing can also correlate with heavily overlapping traffic and other measured signals.

Pixalate is MRC-accredited for sophisticated invalid traffic (SIVT) detection and filtration. For the exact scope of the accreditation, see MRC accreditation. For every IVT type Pixalate reports, see the IVT taxonomy.

On CTV, legitimate apps often use several bundle IDs, so a bundle ID that doesn’t match the store’s ID isn’t necessarily spoofing. Pixalate maps bundle IDs to app store IDs so that legitimate traffic isn’t wrongly flagged. See CTV bundle IDs.

Where to see app spoofing in the MRT

An app’s Insight page in the Media Ratings Terminal (MRT) shows the breakdown of the bundle IDs Pixalate detected for that app across its global data. Use it to separate traffic that’s misrepresented as this app (the AppSpoofing SIVT type) from other IVT on the app when it isn’t misrepresented.

On both mobile and CTV app reports, Potential Bundle Id Spoofing Risk appears under Traffic Trends > Traffic Overview.

CTV app reports also have an App Spoofing section. Its Spoofing Overview shows Apparent Victim of Spoofing and Potential Bundle Id Spoofing Risk, and its tables show user agent, device and bundle ID obfuscation: the declared bundle ID, the bundle ID Pixalate detected, and the share of voice. An Include Spoofing toggle at the top of CTV app reports includes or leaves out spoofed inventory.

The spoofing labels are:

Label	What it means
App Spoofing	Traffic where the app identifier (for example, the bundle ID) reported to the exchange doesn’t match the characteristics of the app detected by Pixalate.
Apparent Victim of Spoofing	Whether a significant number of impressions detected for the app may be misrepresented in advertising transactions.
Potential Bundle Id Spoofing Risk	The risk that the app is misrepresented in advertising transactions and ads are delivered to a different app or site.
Impression Volume Obfuscation	The app’s traffic is associated with potential background activity that fires multiple impressions at once.
Device Obfuscation	The app’s traffic comes from obfuscated device identifiers.
User Agent Obfuscation	The user agent detected by Pixalate doesn’t match the user agent passed in the bid request.

For the full list of labels, see the Glossary.

For CTV apps, Pixalate also reports a spoofing percentage for each seller of the app, based on the app’s app-ads.txt file. It’s the share of spoofed inventory for that app that a buyer may encounter when buying from that seller. It applies to that seller and that app only, not to the seller overall. In the Enrichment API, it’s authorizedSellers[].spoofingRate.

App spoofing in the Enrichment API

For CTV apps, the Enrichment API returns spoofing data in the appSpoofing widget, including whether the app is a victim of spoofing, its spoofing risk, and the declared and detected bundle IDs by fraud type. The includeSpoofing parameter works like the Include Spoofing toggle: it’s on by default, and includeSpoofing=false leaves spoofed traffic out of the IVT figures. See appSpoofing in the CTV field reference.

Pixalate’s app spoofing reports

Pixalate publishes app spoofing reports at pixalate.com/reports. They list apps whose app spoofing rate, as measured by Pixalate, meets a materiality threshold, so they focus on apps significantly affected by spoofing. The filtered list is ranked by the total number of app spoofing impressions measured for each app.

To keep the data accurate, Pixalate:

manually reviews apps with high app spoofing rates, to confirm that the automated detection is finding clear IVT and not tag implementation errors
reviews apps whose spoofing involves mismatched bundle IDs or unusual user agents, to confirm the mismatch
cross-checks the data across Pixalate’s global data, to cancel out bias from any single source

How to reduce your exposure

Validate app-ads.txt and sellers.json strictly, not just for presence, so you buy only from sellers authorized for the app.
Measure your exposure with Pixalate’s Analytics and the MRT, and block high-risk supply with Pixalate’s pre-bid data feeds.

For more background, read Pixalate’s blog post on mobile app laundering.

CTV bundle IDs

Why CTV bundle IDs are unreliable, and how Pixalate maps them.

Glossary

Definitions for every label and tooltip in the MRT.

IVT taxonomy

Every IVT type Pixalate measures.

Questions? Email support@pixalate.com.